On Tue, Nov 29, 2011 at 03:18:03PM -0500, Mike Snitzer wrote: > On Tue, Nov 29 2011 at 7:00am -0500, > Heiko Carstens <heiko.carstens@xxxxxxxxxx> wrote: > > [ 4906.683654] Unable to handle kernel pointer dereference at virtual kernel address 6b6b6b6b6b6b6000 > > ... > > > Gonzalo also tried 2.6.38.8 as suggested and ran into this one: > > > > [ 292.877936] ------------[ cut here ]------------ > > [ 292.877939] Kernel BUG at 6b6b6b6b6b6b6b6d [verbose debug info unavailable] > > Again, more poison. > > Seems this test is causing us to fall on our face no matter what. > Likely, best to leave this 2.6.38 blk_unplug crash to one side and > continue focusing on latest upstream. Sorry again, for taking so long to come back. This time however with good news: With 3.2.0-rc4.00255.g77a7300 we were unable to reproduce any I/O stall or user-after-free bugs even after nearly 3000 test iterations. The only patches on top we have are: two patches from Hannes: http://www.spinics.net/lists/linux-scsi/msg55112.html http://www.spinics.net/lists/linux-scsi/msg55413.html and the patch below from Steffen: Btw. James, any chance to get this one upstream soon? It should be in your queue for quite some time already, IIRC. Subject: [PATCH] zfcp: return early from slave_destroy if slave_alloc returned early From: Steffen Maier <maier@xxxxxxxxxxxxxxxxxx> zfcp_scsi_slave_destroy erroneously always tried to finish its task even if the corresponding previous zfcp_scsi_slave_alloc returned early. This can lead to kernel page faults on accessing uninitialized fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the port field of the struct to determine if slave_alloc returned early. This zfcp bug is exposed by 4e6c82b (in turn fixing f7c9c6b to be compatible with 21208ae) which can call slave_destroy for a corresponding previous slave_alloc that did not finish. This patch is based on James Bottomley's fix suggestion in http://www.spinics.net/lists/linux-scsi/msg55449.html. Signed-off-by: Steffen Maier <maier@xxxxxxxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxx> #2.6.38+ --- drivers/s390/scsi/zfcp_scsi.c | 4 ++++ 1 file changed, 4 insertions(+) diff -urpN linux-2.6/drivers/s390/scsi/zfcp_scsi.c linux-2.6-patched/drivers/s390/scsi/zfcp_scsi.c --- linux-2.6/drivers/s390/scsi/zfcp_scsi.c 2011-12-01 13:08:32.000000000 +0100 +++ linux-2.6-patched/drivers/s390/scsi/zfcp_scsi.c 2011-12-01 13:08:52.000000000 +0100 @@ -55,6 +55,10 @@ static void zfcp_scsi_slave_destroy(stru { struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev); + /* if previous slave_alloc returned early, there is nothing to do */ + if (!zfcp_sdev->port) + return; + zfcp_erp_lun_shutdown_wait(sdev, "scssd_1"); put_device(&zfcp_sdev->port->dev); } -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
